Vercel KMS Quickstart

Sign a JWT from a Vercel Function with a Vercel-managed key, then verify it against the issuer's published JWKS. This takes four steps and no private key material in your deployment.

• A Vercel project deployed as, or containing, a Vercel Function.
• The @vercel/kms package installed in your project.

1. Create a signing issuer

   In the Vercel dashboard, open your team's Key Management settings and create an issuer. KMS generates a signing key for the issuer using the default RS512 algorithm.

   Copy the issuer's ID. You reference it whenever you sign, and it forms the public issuer URL at https://kms.vercel.com/<issuerId>.

2. Install the SDK

   Install @vercel/kms in your project:

   pnpm i @vercel/kms

3. Sign a token from a Vercel Function

   Call signToken inside a route handler. Inside a Vercel Function, the deployment's OIDC token authorizes the request automatically, so you pass no credentials:

   signToken resolves the function's OIDC token at call time, which requires an active request context. Call it inside a route handler or Server Component, not at the module top level.

   app/api/sign/route.ts

   import { signToken } from '@vercel/kms';
    
   export async function GET() {
     const token = await signToken({
       issuerId: 'f47ac10b-58cc-4372-a567-0e02b2c3d479',
       claims: { sub: 'user_123', scope: 'read:data' },
       ttl: 300, // seconds
     });
    
     return Response.json({ token });
   }

   KMS sets the iat, nbf, and exp claims, and ttl defaults to 300 seconds.

4. Verify the token

   A relying party verifies the token against the issuer's JWKS. This example uses jose:

   verify.ts

   import { createRemoteJWKSet, jwtVerify } from 'jose';
    
   const issuer = 'https://kms.vercel.com/f47ac10b-58cc-4372-a567-0e02b2c3d479';
   const jwks = createRemoteJWKSet(new URL(`${issuer}/jwks.json`));
    
   const { payload } = await jwtVerify(token, jwks, { issuer });

• SDK Reference: sign messages, set the region, or call the signing API directly.
• Authentication: how signing and management requests are authorized.
• Key rotation: rotate signing keys without breaking verification.